Code injection in Stripe CLI on windows

CAO 7.0CVE-2022-24753 · GHSA-4cx6-fj7j-pjx9 · GO-2022-0350 · Công bố 09/03/2022 · cập nhật 17/06/2026

Tóm tắt nhanh

CVE-2022-24753 là lỗ hổng mức CAO (CVSS 7.0) ảnh hưởng github.com/stripe/stripe-cli, stripe cli (stripe).
Xác suất bị khai thác trong 30 ngày tới (EPSS): 0.36%, cao hơn 30.5% các lỗ hổng khác.
Cách xử lý: cập nhật lên 1.7.13 hoặc mới hơn.

Gói / sản phẩm	Phiên bản bị ảnh hưởng	Phiên bản đã vá
github.com/stripe/stripe-cli Go	`< 1.7.13`	`1.7.13`
stripe cli stripe	`< 1.7.13`	`1.7.13`

Mô tả

Impact

A vulnerability in Stripe CLI exists on Windows when certain commands are run in a directory where an attacker has planted files. The commands are stripe login, stripe config -e, stripe community, and stripe open. MacOS and Linux are unaffected.

An attacker who successfully exploits the vulnerability can run arbitrary code in the context of the current user. The update addresses the vulnerability by throwing an error in these situations before the code can run.

There has been no evidence of exploitation of this vulnerability.

Recommendation

Upgrade to Stripe CLI v1.7.13.

Acknowledgments

Thanks to trungpabc for reporting the issue.

For more information

Email us at [email protected].

Mô tả của NVD

Stripe CLI is a command-line tool for the Stripe eCommerce platform. A vulnerability in Stripe CLI exists on Windows when certain commands are run in a directory where an attacker has planted files. The commands are `stripe login`, `stripe config -e`, `stripe community`, and `stripe open`. MacOS and Linux are unaffected. An attacker who successfully exploits the vulnerability can run arbitrary code in the context of the current user. The update addresses the vulnerability by throwing an error in these situations before the code can run.Users are advised to upgrade to version 1.7.13. There are no known workarounds for this issue.